← All credits

Red Hat would like to thank Arpit Jain (Independent Security Researcher) for reporting this issue.

3 vulnerability records and advisories credit this contributor.

CVE-2026-107152

Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed

Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

CVE-2026-107151

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests